7

Since I want to protect my ssh connections, I set some global cipher suite options to restrict set of used algorithms. But recently I've encountered a server which doesn't support some of those algorithms. So, I need to selectively enable deprecated algorithms for a specific host record in client (my system) configuration.

I found out that the options override is not working as I expected. Let's take a minimal (not-)working example for the github:

HostKeyAlgorithms [email protected],ssh-ed25519,[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp256

Host github
    HostKeyAlgorithms ssh-rsa
    Hostname        github.com
    Port            22
    User            git
    PubkeyAuthentication yes
    IdentityFile    ~/.ssh/some-filename-here

Having that, I receive the following error (HostKeyAlgorithms is not overriden at all):

debug1: /home/username/.ssh/config line 14: Applying options for github
<...>
debug2: kex_parse_kexinit: [email protected],ssh-ed25519,[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp256
<...>
Unable to negotiate with 192.30.252.130: no matching host key type found. Their offer: ssh-dss,ssh-rsa

It is similarly not working for the global PubkeyAuthentication no options with an override in a host configuration.

Also, the match doesn't help either:

match host github
    HostKeyAlgorithms ssh-rsa

So, is there a way to selectively redefine those options?

NOTE: I'm using the openssh-7.1_p2-r1 on gentoo.

Improve this question

2 Answers 2

Reset to default
6

OpenSSH options might behave somehow strange on the first sight. But manual page for ssh_config documents it well:

For each parameter, the first obtained value will be used. The configuration files contain sections separated by “Host” specifications, and that section is only applied for hosts that match one of the patterns given in the specification. The matched host name is usually the one given on the command line (see the CanonicalizeHostname option for exceptions.)

You might rewrite your config like this to achieve what you need:

Host github
    HostKeyAlgorithms ssh-rsa
    Hostname        github.com
    Port            22
    User            git
    PubkeyAuthentication yes
    IdentityFile    ~/.ssh/some-filename-here
Host *
    HostKeyAlgorithms [email protected],ssh-ed25519,ecdsa-sha2-nistp5[email protected],ecdsa-sha2-nistp521,ecdsa-sha2-nistp256
Improve this answer
1

Apart from a few specific (often used) options like -p to set the port, there is the generic -o options.

ssh -o HostKeyAlgorithms=ssh-algamel

can override that value

Improve this answer
3
  • Yes, but it is unusable for use cases like git over ssh.
    – Alexander Sergeyev
    Apr 4, 2016 at 10:56
  • Not enterily true: GIT_SSH="ssh -o HostKeyAlgorithm=XYZ" git push can override your settings on an individual basis
    – Anthon
    Apr 4, 2016 at 11:06
  • Okay, but then it will affect each ssh connection which is made by git (when I put it in .bashrc). And, I think, every way to overcome the issue will be much more uglier then the proper ssh_config changes.
    – Alexander Sergeyev
    Apr 4, 2016 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .